The speed was the same for everyone
A maturity study where velocity rose evenly and complexity did not, credentials that expire on their own, and a review of what testing assumes about the thing it tests.
How we Organise
Repository maturity and the cost that does not show up in velocity
Agents lifted commits by 28 to 38 per cent whatever configuration a team had. Quality did not follow. Repositories with no configuration showed twice the rise in complexity, 53 per cent against 27.
We ask a client to work out what one good outcome costs, fully loaded. The trouble is where the figure is read. It settles when something ships, and both groups here ship at the same rate. A firm would find them indistinguishable while one accumulates twice the complexity, and somebody pays for that later. The authors call it a hypothesis.
How we Build
Vercel on replacing stored credentials with ones an agent asks for
Putting a long-lived credential in a vault makes it harder to steal and no less dangerous once stolen. The alternative shipped here stores nothing. An application asks for a credential at runtime, scoped to the request, and it expires on its own.
Our position is that an agent’s reach is settled by its credential, not by a document about what it may touch. Here that arrives as shipped infrastructure rather than an argument for it, with the properties it asks for: short lifetime, reach scoped to the task, a named identity. It is a vendor describing its own product.
How we Assure
A review of what military testing practice assumes about the thing it tests
A review of 240 documented testing practices drew out eight assumptions about the thing under test: that it can be specified, that it is stable, that it composes, that it can be supervised. Agentic properties weaken all eight. What erodes is the argument joining evidence to claim.
The rule we give a client is that any change able to alter behaviour reopens the assessment. There is a hinge in that, because a change is something somebody makes and ships. None of this drift arrives that way. No release is cut, and the system carrying authority this morning is not the one the evidence came from.